Unfortunately I cannot create a Github issue due to github blocking me. There has been a security regression in Qubes that is causing data leakage to disks when it should not be.
Qubes officially supports COW + ephemeral encryption of the root volume of an AppVM. This means data written to / will go to an ephemerally encrypted volume and will disappear forever when the VM is shutdown with no way for data recovery.
The issue is that Qubes is changing user settings at startup and as a result no COW of / is being created. Users may expect that it is created because it will work until a restart of the machine occurs. The end result is that Qubes users sensitive data is being leaked to their harddrive without their knowledge.
Why does this issue occur?
In order to create the COW the root volume of the Qube must have “RW” set to “False”. Doing this will work 100% correctly which is why this issue is so dangerous. Users may believe they are being protected. The problem is that upon restarting the machine Qubes will silently change users volume configuration and set the “RW” flag to “True”. Thus, COW now is disabled, no redirection to an ephemeral encrypted device as expected, etc. User data is now exposed with no warning.
How to Fix this?
Qubes is changing user-defined configuration values on startup of the machine. I am not sure where it is occurring, but it can be 100% reproduced that every startup Qubes will silently and without consent change the RW flag of the root partition. This is verified in qvm-volume immediately after bootup.
Whatever mechanism that changes these configuration values forcibly at start is breaking an official configuration setting of Qubes and exposing user data to the disk that users explicitly thought was being protected.